AV/EDR Lab Environment Setup

Several enterprise-grade security products offer free trials that can be used to build a high-fidelity lab:

• Microsoft Defender for Endpoint: Use the Defender Endpoint Trial User Guide to set up a lab for free.
• Huntress Managed EDR: Offers a 15-day free trial with no credit card required (includes 3 high/critical incident reports).
• Elastic EDR: Can be deployed via Docker using tools like elastdocker or elastic-container.
• Other Trials: Sophos XDR, TrendMicro, McAfee MVISION, and Avast also offer trial versions.

You can emulate advanced EDR capabilities (like SACL monitoring and API hooking) using open-source tools to build a lab environment without expensive licenses.

SACL (System Access Control List) Emulation

Use Sysmon as a viable alternative to EDR for monitoring system events.

• Recommended configuration: SwiftOnSecurity sysmon-config

API Hooking Detection

To understand how EDRs intercept function calls, use these tools:

• HookDetector: Detects all hooked APIs.
• TelemetrySourcerer: Enumerates and can disable common telemetry sources, including ETW, User-Mode Hooks, and Kernel Callbacks.

To test if your malware bypasses user-mode hooks by using direct syscalls, use the following tools to identify manual syscall execution on Windows:

• syscall-detect: General detection of manual syscalls.
• Process-Instrumentation-Syscall-Hook: Hooks the current process to identify manual syscall executions.
• Hunt-Weird-Syscalls: Specifically designed to hunt for anomalous syscall patterns.

Instead of commercial products, you can use these open-source EDR implementations to study detection logic:

• RedEDR: A prominent open-source EDR.
• OpenEDR: Provided by Comodo Security.
• SimpleEDR: Focuses on manual DLL hooking to find detection opportunities.
• CrimsonEDR: Another open-source implementation.
• Other options: MyDumbEDR, SylantStrike, Whids, and JonMon.

Event Tracing for Windows (ETW) and Threat Intelligence (ETW-TI) are critical telemetry sources for EDRs. Use these tools to inspect, consume, or manipulate them:

Inspection and Enumeration

• ETWInspector: Inspect ETW providers.
• ETWListicle: List ETW Providers for a specific process.
• EtwExplorer: View ETW Providers Manifest.
• PockETWatcher: Monitor ETW activity.

Consumption and Analysis

• KrabsETW / BlueKrabsETW: Microsoft-based ETW consumers (BlueKrabs is optimized for Blue Teams).
• SealighterTI: A Threat-Intelligence ETW Provider.
• TiEtwAgent: Detects memory injection based on ETW-TI.
• MentalTi: An ETW-TI parser.
• PyWinTrace: Python library for ETW.

Learning Resources

• EVTX-ETW-Resources: A repository dedicated to learning and understanding EVTX/ETW.

Use these tools to test and improve your ability to bypass signature-based detection:

• ThreatCheck: A tool for checking/testing signatures.
• AvRed: Specifically for signature bypass research.

To detect artifacts left in memory or suspicious image loads, use these specialized scanners:

Process Memory Scanners

• PE-sieve: Scans for in-memory modifications.
• Moneta: Detects memory anomalies.
• YapScan: Uses YARA rules to scan memory.
• MalMemDetect: Specifically for detecting malware in memory.
• BeaconEye / BeaconHunter: Specialized for detecting Cobalt Strike Beacons.

Image Load Scanners

• Hunt-Weird-ImageLoads: Detects suspicious image loading patterns.